Terraform modules
Drop-in replacements for terraform-aws-modules with compliance controls enforced at terraform plan time. Same arguments, same outputs.
The compliance.tf catalog runs to 51 modules, every one of them served from the registry. The 36 below, across 8 categories, have a published control breakdown. Each one is API-compatible with its upstream terraform-aws-modules counterpart. Change the source URL, run terraform plan, and controls are checked before anything gets deployed.
Storage
| Module | Controls | Frameworks |
|---|
| EFSAmazon EFS file systems with mount targets, access points, backup policies, lifecycle management, encryption at rest, and security group controlled NFS access. | 5 | 23 |
|---|
| FSxAmazon FSx file systems for Windows, Lustre, NetApp ONTAP, or OpenZFS with storage capacity, throughput, backups, encryption, and deployment in private subnets. | 9 | 22 |
|---|
| S3 BucketS3 buckets with versioning, default encryption, public access blocks, bucket policies, access logging, lifecycle rules, replication, event notifications, and optional object lock controls. | 17 | 27 |
|---|
Compute & Containers
| Module | Controls | Frameworks |
|---|
| AutoscalingAuto Scaling groups with launch templates, instance refresh, health checks, scaling policies, mixed instance options, IAM instance profiles, and security group based network controls. | 2 | 5 |
|---|
| EC2 InstanceEC2 instances with IAM roles, EBS encryption, IMDSv2, security groups, detailed monitoring, user data, placement options, and optional Elastic IPs or attached volumes. | 11 | 25 |
|---|
| LambdaLambda functions with IAM execution roles, VPC configuration, log groups, reserved concurrency, dead letter handling, environment variables, code signing support, and optional KMS encryption. | 10 | 21 |
|---|
| ECSECS clusters, services, and task definitions with IAM roles, logging, load balancer integration, service discovery, capacity providers, and Fargate or EC2 runtime settings. | 8 | 22 |
|---|
| EKSEKS clusters with managed node groups, Fargate profiles, cluster encryption, IAM and OIDC integration, VPC networking, control plane logging, security groups, and core add-ons. | 11 | 22 |
|---|
| ECRECR repositories with image scanning, immutable tags, KMS encryption, lifecycle policies, repository policies, replication, and controlled push and pull access. | 2 | 8 |
|---|
Networking & Edge
| Module | Controls | Frameworks |
|---|
| ALBApplication Load Balancers with listeners, listener rules, target groups, TLS certificates, access logs, WAF integration, and security group restricted ingress. | 13 | 23 |
|---|
| CloudFrontCloudFront distributions with origins, origin access control, TLS certificates, cache behaviors, WAF association, logging, geo restrictions, and HTTPS only content delivery. | 9 | 16 |
|---|
| ELBClassic Load Balancers with listeners, health checks, SSL certificates, cross zone balancing, connection draining, access logging, and security group controlled ingress. | 3 | 15 |
|---|
| Network FirewallAWS Network Firewall rule groups, firewall policies, firewalls, logging destinations, stateless and stateful inspection rules, and subnet placement for traffic filtering. | 4 | 5 |
|---|
| VPCVPCs with public and private subnets, route tables, NAT gateways, Internet gateways, VPC endpoints, flow logs, network ACLs, and security group foundations for workload isolation. | 4 | 21 |
|---|
| VPN GatewaySite to site VPN connections with customer gateways, VPN gateways or transit gateway attachments, tunnels, routing propagation, and encrypted connectivity between on premises networks and AWS. | 1 | 2 |
|---|
| WAFv2WAFv2 web ACLs, rule groups, IP sets, and regex pattern sets with managed and custom rules, CloudWatch visibility metrics, logging configuration, and CloudFront or regional scope for request filtering. | 1 | 7 |
|---|
| Security GroupTerraform module which creates EC2 security groups on AWS with support for ingress/egress rules, computed rules, and rule descriptions. | 2 | 13 |
|---|
Databases, Caching & Analytics
| Module | Controls | Frameworks |
|---|
| DMSDatabase Migration Service replication instances, source and target endpoints, replication tasks, subnet groups, logging, and controlled network placement for data migration. | 5 | 19 |
|---|
| DynamoDB TableDynamoDB tables with server side encryption, point in time recovery, TTL, streams, autoscaling, global tables, IAM access controls, and backup oriented settings. | 4 | 20 |
|---|
| ElastiCacheRedis or Memcached clusters and replication groups with subnet groups, security groups, transit and at rest encryption, auth tokens, parameter groups, and automatic failover. | 10 | 22 |
|---|
| OpenSearchOpenSearch domains with VPC placement, encryption at rest, node to node encryption, fine grained access control, audit logs, TLS enforcement, and snapshot configuration. | 12 | 22 |
|---|
| RDSRDS instances with subnet groups, security groups, storage encryption, automated backups, maintenance windows, performance insights, IAM authentication, and log exports. | 21 | 26 |
|---|
| RDS AuroraAurora clusters and instances with private subnet placement, storage encryption, automated backups, reader endpoints, IAM authentication, log exports, and multi AZ high availability. | 16 | 25 |
|---|
| RedshiftRedshift clusters or serverless workgroups with VPC networking, encryption, audit logging, snapshot settings, parameter groups, enhanced VPC routing, and controlled access. | 17 | 23 |
|---|
| EMREMR clusters and instance groups with security configurations, encryption in transit and at rest, Kerberos, IAM roles, bootstrap actions, logging, and deployment in private subnets. | 5 | 22 |
|---|
Security, Keys & Configuration
| Module | Controls | Frameworks |
|---|
| ACMACM certificates and validation records for public or private TLS, certificate renewal, and associations used by load balancers, CloudFront distributions, and APIs. | 2 | 5 |
|---|
| KMSKMS keys, aliases, grants, key policies, rotation, multi Region options, and tightly scoped permissions used to encrypt data across AWS services. | 1 | 20 |
|---|
| Secrets ManagerSecrets, secret versions, rotation schedules, KMS encryption, resource policies, replication, and controlled retrieval of database passwords, API keys, and tokens. | 1 | 7 |
|---|
| SSM ParameterSystems Manager Parameter Store parameters with KMS encryption, parameter policies, versioning, tier selection, and controlled access to application configuration and secret values. | 1 | 1 |
|---|
Messaging & Streaming
| Module | Controls | Frameworks |
|---|
| MSK Kafka ClusterMSK clusters with broker configuration, encryption in transit and at rest, client authentication, logging, VPC networking, and cluster policies for streaming workloads. | 5 | 21 |
|---|
| SNSSNS topics and subscriptions with KMS encryption, topic policies, delivery policies, dead letter configuration, and controlled fan out of events and notifications. | 1 | 18 |
|---|
| SQSSQS queues with server side encryption, access policies, FIFO options, visibility timeout, redrive policies, and dead letter queues for durable message processing. | 2 | 4 |
|---|
API & Application Integration
| Module | Controls | Frameworks |
|---|
| API Gateway v2HTTP and WebSocket APIs with routes, stages, custom domains, TLS certificates, access logs, JWT or Lambda authorizers, throttling, and private or public integrations. | 5 | 21 |
|---|
| AppSyncGraphQL APIs with resolvers, data sources, API keys or IAM and Cognito authentication, logging, caching, custom domains, and fine grained access patterns. | 4 | 8 |
|---|
| Step FunctionsState machines with IAM execution roles, logging, tracing, retries, timeouts, and workflow definitions for auditable application orchestration. | 3 | 21 |
|---|
Observability
| Module | Controls | Frameworks |
|---|
| CloudWatchLog groups, metric alarms, dashboards, retention settings, subscription filters, and event rules used for monitoring, alerting, forensic visibility, and audit support. | 4 | 22 |
|---|
Compliance.tf modules enforce SOC 2, PCI DSS, HIPAA, and 35+ frameworks with a single source URL change. No extra tools, no post-deploy scanning.
Start free trialGet started
